Vulnerabilities
All
My stack
Known exploited
Public exploit
Critical (9+)
Likely exploited (EPSS ≥ 50%)
Changed, 24 h
New, 24 h
Sort:
risk
modified
published
CVSS
EPSS
| CVE | CVSS | EPSS | Vendor, product | Description | Modified |
|---|---|---|---|---|---|
| CVE-2025-58321 | 10.0 critical | 1.0% | deltaww, dialink | Delta Electronics DIALink has an Directory Traversal Authentication Bypass Vulnerability. | 18 Oct |
| CVE-2026-1949 | 9.8 critical | 1.0% | deltaww, as320t_firmware | Delta Electronics AS320T has incorrect calculation of the buffer size on the stack in the GET/PUT request handler of the web service. | Mon 26 Oct |
| CVE-2026-1951 | 9.8 critical | 1.0% | deltaww, as320t_firmware | Delta Electronics AS320T has no checking of the length of the buffer with the directory name vulnerability. | Mon 26 Oct |
| CVE-2026-12819 | 9.3 critical | 1.0% | no CPE yet | Delta Electronics DVP12SE PLC exposes a Modbus TCP service over a specified port without authentication or access control, permitting unauthenticated interaction with security-sensitive PLC functions. | Sun 25 Oct |
| CVE-2026-1950 | 9.8 critical | 0.00% | deltaww, as320t_firmware | Delta Electronics AS320T has No checking of the length of the buffer with the file name vulnerability. | Mon 26 Oct |
| CVE-2026-12818 | 9.3 critical | 0.00% | no CPE yet | Delta Electronics DVP12SE PLCs are susceptible to a resource allocation vulnerability without limits or throttling (CWE-770) within their Modbus TCP service. | Sun 25 Oct |
| CVE-2026-22110 | 8.7 high | — | delta electronics, delta ufc500 | The web server does not check authentication on POST or PUT. An unauthenticated attacker can reboot the charger; by brute-forcing the configid, they can also set the service password and then change any setting. | 4 h ago |
| CVE-2026-22105 | 8.7 high | — | delta electronics, delta ufc500 | Delta UFC500 charging stations derive the default credentials of the Service account from character positions of the device serial number. An unauthenticated attacker with adjacent network access can reconstruct the resulting password, or exhaust the keyspace, and log in to read and change sensitive settings such as the OCPP backend. | 4 h ago |
| CVE-2026-22109 | 8.4 high | — | delta electronics, delta ufc500 | The shipped WebUI template database retains the factory default passwords for all five account types in cleartext. Defaults are identical across devices and were unchanged on the tested unit. | 4 h ago |
| CVE-2023-0251 | 7.8 high | 0.00% | deltaww, diascreen | Delta Electronics DIAScreen versions 1.2.1.23 and prior are vulnerable to a buffer overflow through improper restrictions of operations within memory, which could allow an attacker to remotely execute arbitrary code. | Wed 28 Oct |
| CVE-2026-1952 | 7.5 high | 0.00% | deltaww, as320t_firmware | Delta Electronics AS320T has denial of service via the undocumented subfunction vulnerability. | Mon 26 Oct |
| CVE-2025-59301 | 7.5 high | 0.00% | deltaww, dvp15mc11t_firmware | Delta Electronics DVP15MC11T lacks proper validation of the modbus/tcp packets and can lead to denial of service. | 19 Oct |
| CVE-2025-59297 | 6.8 medium | 0.00% | deltaww, diascreen | Delta Electronics DIAScreen lacks proper validation of the user-supplied file. If a user opens a malicious file, an attacker can leverage this vulnerability to execute code in the context of the current process. | 12 Oct |
| CVE-2025-59298 | 6.8 medium | 0.00% | deltaww, diascreen | Delta Electronics DIAScreen lacks proper validation of the user-supplied file. If a user opens a malicious file, an attacker can leverage this vulnerability to execute code in the context of the current process. | 12 Oct |
| CVE-2025-59299 | 6.8 medium | 0.00% | deltaww, diascreen | Delta Electronics DIAScreen lacks proper validation of the user-supplied file. If a user opens a malicious file, an attacker can leverage this vulnerability to execute code in the context of the current process. | 12 Oct |
| CVE-2025-59300 | 6.8 medium | 0.00% | deltaww, diascreen | Delta Electronics DIAScreen lacks proper validation of the user-supplied file. If a user opens a malicious file, an attacker can leverage this vulnerability to execute code in the context of the current process. | 12 Oct |
| CVE-2026-22114 | 5.3 medium | — | delta electronics, delta ufc500 | HTTP basic auth enforces no retry limit or backoff. Combined with the default service password, the keyspace is exhaustible. | 4 h ago |
17 of 17
Download these 17 as CSV · subscribe to this list.
EPSS scores: 2026-10-29. NVD cursor: 2026-10-29 00:22. The News page shows only notable CVEs (KEV, your stack, new criticals, EPSS over 50%, or active exploitation per SSVC); this table has all of them.